WebScout
Subdomain recon & live-host enumeration
Enter a target domain and WebScout runs subfinder piped into httpx, streaming enriched live-host results to the browser in real time over SSE, then exports HTML, CSV and JSON reports — with optional Discord, Slack or Telegram alerts on completion or failure.
- Python · FastAPI
- Vanilla JS · HTML/CSS
- SSE
- subfinder
- httpx
Context
WebScout is a web-based reconnaissance tool for the first move of any assessment: given a target domain, map the attack surface — every discoverable subdomain, narrowed to the hosts that are actually live.
The problem
Subdomain enumeration and live-host probing are bread-and-butter recon, but the usual flow is a chain of CLI tools whose output you stitch together by hand. That's fine at a terminal, solo; it's awkward to run repeatably, watch as it happens, or hand to anyone who isn't living in a shell.
Approach
WebScout wraps a proven pipeline — subfinder for passive subdomain discovery, piped into httpx for live-host probing — behind a browser UI. The backend is a small FastAPI service with no database: each scan is held in memory, keyed by a scan id, so several can run side by side. Starting a scan spawns the subfinder-into-httpx pipeline and parses each JSON line as it arrives; the browser holds one Server-Sent Events connection per scan, so live hosts — with status, title, detected tech, server, IP and CDN — appear in the table as they resolve instead of after the whole run. In-flight scans can be cancelled (which tears down the subprocess) and long runs time out rather than hang. Completed scans export to HTML, CSV, or JSON, and optional Discord, Slack, or Telegram notifications fire once on completion or failure. The front end is deliberately plain — vanilla JS, HTML and CSS, no framework.
Securing it
For an offensive tool, the security substance is in the guardrails around it — and here they're concrete. A scan won't even start until the request carries an explicit authorization acknowledgment: the API rejects it with a 400 otherwise, so the "I am authorized to test this target" gate is enforced server-side, not just as a checkbox. The target domain is validated before it's ever handed to the pipeline, so a user-supplied string can't be smuggled into the subprocess call. And notification credentials stay in the browser's localStorage, sent only as part of your own scan request — never stored server-side.
What shipped
Shipped — a working tool that takes a domain and returns a live, streamed live-host map with HTML/CSV/JSON exports and chat-app notifications. Source is on GitHub; there's no public hosted instance by design, since running recon tooling as an open service invites abuse — it's meant to run locally or self-hosted.
Links